CVE-2025-68031 describes a reflected cross-site scripting vulnerability in the faraz sms افزونه پیامک حرفه ای فراز اس ام اس plugin versions up to 2.7.3. The issue is caused by improper neutralization of input during web page generation, which allows an attacker to inject malicious scripts that execute in the victim's browser when a crafted URL or input is processed. The vulnerability has a CVSS 3.1 base score of 7.1, reflecting network attack vector, low complexity, no privileges required, user interaction needed, and impacts confidentiality, integrity, and availability at a low level. There is no vendor advisory or patch information currently available, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to information disclosure, session hijacking, or other user-targeted attacks. The CVSS score of 7.1 indicates a high severity with impacts on confidentiality, integrity, and availability at a low level. However, no known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users of the affected plugin should monitor vendor communications for updates. Until a fix is available, users should consider limiting exposure by restricting access or employing web application firewalls that can detect and block reflected XSS attempts.